434 matches found
Gogs <= 0.14.2 - Authenticated RCE via git rebase Argument Injection
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution RCE on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before...
dyen
dyen dyen loads a Mach-O dylib in memory using stock macOS Python and calls an exported entry point without dlopen on that dylib. The aim is that the image is never a standalone file on the target and is never registered with dyld. by cenobyte [email protected] 2026...
UBUNTU-CVE-2026-105437
Affected versions of Git have a heap buffer overflow in the three-way merge code xdiff, which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. Tha...
AZL-113311 CVE-2026-105437 affecting package git 2.45.4-3
Affected versions of Git have a heap buffer overflow in the three-way merge code xdiff, which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. Tha...
EUVD-2026-101749
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before...
CVE-2026-110866
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before...
CVE-2026-110866 Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before...
CVE-2026-110866
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before...
CVE-2026-110866
Versions of Renovate prior to 44.61.3 are vulnerable to a protection mechanism bypass (CWE-693). The flaw allows an attacker to skip minimumReleaseAge checks when a user requests a PR rebase using the rebase/retry checkbox. This enables an attacker who publishes a malicious dependency to have tha...
CVE-2026-110866 Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before...
CVE-2026-110866 Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before...
PT-2026-114180
Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.61.3 Description A protection mechanism bypass exists that allows minimumReleaseAge checks to be skipped when a user requests a Pull Request PR rebase using the rebase/retry checkbox. This allows an attacker to...
CVE-2026-110866: Protection Mechanism Failure
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before...
CVE-2026-52806
Gogs RCE — Argument Injection in git rebase CWE-88 Authenticated remote code execution against Gogs is parsed by Git as the --exec flag rather than a positional argument, causing sh -c to run after each replayed commit during the rebase. How the exploit works 1. Pre-flight — determines if the...
Command Injection
Overview org.webjars.npm:simple-git is an A light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Command Injection via the rebase command handler and the trailer..cmd/trailer..command configuration keys, which allow an...
Command Injection
Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Command Injection via the rebase command handler and the trailer..cmd/trailer..command configuration keys, which allow an attacker to inject the...
CLSA-2026-1790281275 Update of libblockdev
rebase to 2.18-5.0.1.el7 - drop the 1 TuxCare CVE backport; 2.18 already incorporates it - no TuxCare CVE patches remain; the .tuxcare.elsN suffix keeps the ELS channel authoritative...
CLSA-2026-1789734185 Update of libblockdev
rebase to 2.18-5.0.1.el7 - drop the 1 TuxCare CVE backport; 2.18 already incorporates it - no TuxCare CVE patches remain; the .tuxcare.elsN suffix keeps the ELS channel authoritative...
Oracle Linux 9 : openssl (ELSA-2026-500327)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500327 advisory. 3.5.8-1.0.1 - Replace upstream references Orabug: 34340177 3.5.8.openela.0.1 - Add OpenELA specific changes 1:3.5.8-1 - Rebase to OpenSSL 3.5.8...
